Skip to content

Commit 0605e81

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #8180 from upodroid/datadog-eks
deploy datadog to kops eks cluster and upgrade argocd
2 parents 87103d0 + ac6d501 commit 0605e81

File tree

14 files changed

+264
-8
lines changed

14 files changed

+264
-8
lines changed

‎.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,6 @@
44

55
# Ignore vscode config files
66
.vscode
7+
8+
# kustomize charts
9+
kubernetes/*/*/charts/

‎infra/gcp/terraform/k8s-infra-prow-build/iam.tf

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,3 +61,19 @@ resource "google_iam_workload_identity_pool_provider" "eks_cluster" {
6161
allowed_audiences = ["sts.googleapis.com"]
6262
}
6363
}
64+
65+
resource "google_iam_workload_identity_pool_provider" "eks_kops" {
66+
project = module.project.project_id
67+
68+
display_name = "kops"
69+
workload_identity_pool_id = google_iam_workload_identity_pool.eks_cluster.workload_identity_pool_id
70+
workload_identity_pool_provider_id = "kops"
71+
attribute_mapping = {
72+
"google.subject" = "assertion.sub"
73+
}
74+
oidc {
75+
# From EKS cluster created in https://github.com/kubernetes/k8s.io/tree/main/infra/aws/terraform/kops-infra-ci
76+
issuer_uri = "https://oidc.eks.us-east-2.amazonaws.com/id/7283E85C59E9C4129CFD07BAC9378D44"
77+
allowed_audiences = ["sts.googleapis.com"]
78+
}
79+
}

‎kubernetes/apps/datadog.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: ApplicationSet
3+
metadata:
4+
name: datadog
5+
spec:
6+
goTemplate: true
7+
generators:
8+
# targets all clusters
9+
- clusters:
10+
selector:
11+
matchExpressions:
12+
- key: clusterType
13+
operator: Exists
14+
template:
15+
metadata:
16+
name: "datadog-{{ .name }}"
17+
spec:
18+
destination:
19+
namespace: datadog
20+
server: "{{ .server }}"
21+
project: default
22+
source:
23+
path: kubernetes/{{ .name }}/datadog
24+
repoURL: https://github.com/kubernetes/k8s.io
25+
targetRevision: main
26+
syncPolicy:
27+
# automated:
28+
# prune: true
29+
# selfHeal: true
30+
syncOptions:
31+
- CreateNamespace=true

‎kubernetes/apps/kustomization.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ kind: Kustomization
33
resources:
44
# - argocd.yaml This has been manually applied to fix sync issues
55
- atlantis.yaml
6+
- datadog.yaml
67
- external-secrets.yaml
78
- cert-manager.yaml
89
- kyverno.yaml

‎kubernetes/eks-prow-kops/datadog/kustomization.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
namespace: datadog
4+
5+
helmCharts:
6+
- name: datadog
7+
repo: https://helm.datadoghq.com
8+
releaseName: datadog
9+
version: 3.118.0
10+
kubeVersion: "1.29"
11+
valuesFile: values.yaml
12+
13+
resources:
14+
- secrets.yaml

‎kubernetes/eks-prow-kops/datadog/secrets.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: external-secrets.io/v1beta1
2+
kind: ExternalSecret
3+
metadata:
4+
name: datadog-secret
5+
spec:
6+
dataFrom:
7+
- extract:
8+
key: datadog-secrets
9+
secretStoreRef:
10+
kind: ClusterSecretStore
11+
name: k8s-infra-prow-build

‎kubernetes/eks-prow-kops/datadog/values.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
registry: public.ecr.aws/datadog
2+
datadog:
3+
apiKeyExistingSecret: datadog-secret
4+
appKeyExistingSecret: datadog-secret
5+
site: us5.datadoghq.com
6+
clusterName: k8s-infra-kops-prow-build
7+
logs:
8+
enabled: true
9+
containerCollectAll: true
10+
prometheusScrape:
11+
enabled: true
12+
serviceEndpoints: true
13+
kubeStateMetricsCore:
14+
enabled: true
15+
networkMonitoring:
16+
enabled: true
17+
processAgent:
18+
enabled: true
19+
processCollection: true
20+
sbom:
21+
enabled: true
22+
containerImage:
23+
enabled: true
24+
uncompressedLayersSupport: true
25+
host:
26+
enabled: true
27+
clusterAgent:
28+
tokenExistingSecret: datadog-secret
29+
agents:
30+
tolerations: # datadog supports arm64
31+
- key: kubernetes.io/arch
32+
operator: Equal
33+
value: arm64
34+
effect: NoSchedule

‎kubernetes/eks-prow-kops/helm/external-secrets.yaml

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
extraObjects:
2+
- apiVersion: external-secrets.io/v1beta1
3+
kind: ClusterSecretStore
4+
metadata:
5+
name: k8s-infra-prow-build
6+
spec:
7+
provider:
8+
gcpsm:
9+
projectID: k8s-infra-prow-build
10+
11+
- apiVersion: v1
12+
kind: ConfigMap
13+
metadata:
14+
name: google-adc
15+
namespace: external-secrets
16+
data:
17+
adc.json: |
18+
{
19+
"type": "external_account",
20+
"audience": "//iam.googleapis.com/projects/773781448124/locations/global/workloadIdentityPools/prow-eks/providers/kops",
21+
"subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
22+
"token_url": "https://sts.googleapis.com/v1/token",
23+
"service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/kubernetes-external-secrets@k8s-infra-prow-build.iam.gserviceaccount.com:generateAccessToken",
24+
"credential_source": {
25+
"file": "/var/run/secrets/google-iam-token/serviceaccount/token",
26+
"format": {
27+
"type": "text"
28+
}
29+
}
30+
}
31+
32+
extraVolumes:
33+
- name: google-iam-token
34+
projected:
35+
defaultMode: 420
36+
sources:
37+
- serviceAccountToken:
38+
audience: sts.googleapis.com
39+
expirationSeconds: 86400
40+
path: token
41+
- name: google-adc
42+
configMap:
43+
name: google-adc
44+
45+
extraEnv:
46+
- name: GOOGLE_APPLICATION_CREDENTIALS
47+
value: /etc/google/adc.json
48+
49+
extraVolumeMounts:
50+
- mountPath: /var/run/secrets/google-iam-token/serviceaccount
51+
name: google-iam-token
52+
readOnly: true
53+
- mountPath: /etc/google
54+
name: google-adc
55+
readOnly: true

‎kubernetes/gke-utility/argocd/argocd-app-controller-sts.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: apps/v1
2+
kind: StatefulSet
3+
metadata:
4+
name: argocd-application-controller
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: argocd-application-controller
10+
env:
11+
- name: AWS_ROLE_ARN
12+
value: arn:aws:iam::468814281478:role/Prow-EKS-Admin
13+
- name: AWS_WEB_IDENTITY_TOKEN_FILE
14+
value: /var/run/secrets/aws-iam-token/serviceaccount/token
15+
- name: AWS_REGION
16+
value: us-east-2
17+
volumeMounts:
18+
- mountPath: /var/run/secrets/aws-iam-token/serviceaccount
19+
name: aws-iam-token
20+
readOnly: true
21+
volumes:
22+
# AWS IAM token needed to assume role to access the EKS clusters.
23+
- name: aws-iam-token
24+
projected:
25+
defaultMode: 420
26+
sources:
27+
- serviceAccountToken:
28+
audience: sts.amazonaws.com
29+
expirationSeconds: 86400
30+
path: token

‎kubernetes/gke-utility/argocd/argocd-cm-rbac.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,6 @@ metadata:
44
name: argocd-rbac-cm
55
data:
66
policy.default: role:readonly
7+
policy.csv: |
8+
g, kubernetes:sig-k8s-infra-leads, role:admin
9+
scopes: "[groups, email]"

‎kubernetes/gke-utility/argocd/argocd-cm.yaml

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,13 @@ data:
1212
ignoreDifferences: |
1313
jqPathExpressions:
1414
- '.webhooks[]?.clientConfig.caBundle'
15-
resource.exclusions: |
16-
- apiGroups:
17-
- cilium.io
18-
kinds:
19-
- CiliumIdentity
20-
clusters:
21-
- "*"
2215
kustomize.buildOptions: --load-restrictor LoadRestrictionsNone --enable-alpha-plugins
16+
dex.config: |
17+
connectors:
18+
- type: authproxy
19+
id: oauth2-proxy
20+
name: OAuth2 Proxy
21+
config:
22+
userHeader: X-Auth-Request-Email
23+
groupHeader: X-Auth-Request-Groups
24+
userIDHeader: X-Auth-Request-User

‎kubernetes/gke-utility/argocd/argocd-server-dp.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: argocd-server
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: argocd-server
10+
env:
11+
- name: AWS_ROLE_ARN
12+
value: arn:aws:iam::468814281478:role/Prow-EKS-Admin
13+
- name: AWS_WEB_IDENTITY_TOKEN_FILE
14+
value: /var/run/secrets/aws-iam-token/serviceaccount/token
15+
- name: AWS_REGION
16+
value: us-east-2
17+
volumeMounts:
18+
- mountPath: /var/run/secrets/aws-iam-token/serviceaccount
19+
name: aws-iam-token
20+
readOnly: true
21+
volumes:
22+
# AWS IAM token needed to assume role to access the EKS clusters.
23+
- name: aws-iam-token
24+
projected:
25+
defaultMode: 420
26+
sources:
27+
- serviceAccountToken:
28+
audience: sts.amazonaws.com
29+
expirationSeconds: 86400
30+
path: token

‎kubernetes/gke-utility/argocd/clusters.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,3 +95,27 @@ spec:
9595
secretStoreRef:
9696
kind: ClusterSecretStore
9797
name: k8s-infra-prow
98+
---
99+
apiVersion: v1
100+
kind: Secret
101+
metadata:
102+
name: eks-prow-kops
103+
labels:
104+
argocd.argoproj.io/secret-type: cluster
105+
clusterType: prow
106+
environment: prod
107+
prowNamespace: test-pods
108+
cloud: eks
109+
type: Opaque
110+
stringData:
111+
name: eks-prow-kops
112+
server: https://7283E85C59E9C4129CFD07BAC9378D44.gr7.us-east-2.eks.amazonaws.com
113+
config: |
114+
{
115+
"awsAuthConfig": {
116+
"clusterName": "k8s-infra-kops-prow-build"
117+
},
118+
"tlsClientConfig": {
119+
"insecure": true
120+
}
121+
}

‎kubernetes/gke-utility/argocd/kustomization.yaml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ kind: Kustomization
33
namespace: argocd
44

55
resources:
6-
- github.com/argoproj/argo-cd/manifests/ha/cluster-install?ref=v2.11.2
6+
- github.com/argoproj/argo-cd/manifests/ha/cluster-install?ref=v3.0.6
77
- extras.yaml
88
- clusters.yaml
99

@@ -21,3 +21,5 @@ patches:
2121
target:
2222
kind: NetworkPolicy
2323
name: argocd-redis-ha-server-network-policy
24+
- path: argocd-server-dp.yaml
25+
- path: argocd-app-controller-sts.yaml

0 commit comments

Comments
 (0)